Push Notification Authentication System for Passwordless Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in managing and remembering complex passwords, which are often compromised by hackers, leading to security breaches and economic losses, while existing authentication methods require manual input of passcodes or tokens.
Innovation Solution
A system that generates unique time-based passcodes on mobile devices using proprietary algorithms, eliminating the need for users to remember or manually input passcodes, and uses push notifications to authenticate access attempts by verifying user identity through registered mobile devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based authentication is used, then users can access online accounts, but users face challenges in managing and remembering complex passwords and passwords are often compromised by hackers
Solution Approach 1:
The patent extracts the password from the authentication process entirely. Instead of requiring users to input passwords, the system uses push notifications sent to registered mobile devices. The authentication flow removes the password input step completely, replacing it with a push notification that the user simply needs to acknowledge, thereby eliminating password management burden while maintaining security.
Solution Approach 2:
The patent introduces a push notification service as an intermediary between the user's mobile device and the authentication server. The mobile device receives notifications about access attempts and sends back authentication responses, acting as a mediator that eliminates the need for direct password input while providing secure authentication through the notification channel.
2Reliability
If one-time passcodes are used for authentication, then security is improved, but users are required to manually input passcodes or tokens which increases operational complexity
Solution Approach 1:
The patent implements self-service authentication where the mobile device automatically handles the authentication process. When a push notification is received, the device automatically generates and transmits the authentication response without requiring the user to manually input any codes or tokens. The user simply needs to acknowledge the notification, and the device handles all technical authentication steps automatically.
Solution Approach 2:
The patent replaces the mechanical action of manual code input with an automated electronic process. Instead of requiring users to type passcodes or tokens, the system uses automated push notifications and electronic responses transmitted through the mobile device, eliminating the manual input step entirely while maintaining the security benefits of one-time codes.
3Ease of operation
If passwords are stored on websites for authentication, then user access is facilitated, but passwords become vulnerable to hacking and phishing attacks
Solution Approach 1:
The patent extracts passwords from the authentication system entirely. Instead of storing and processing passwords on websites, the system uses push notifications to authenticated mobile devices. This eliminates the vulnerability of stored passwords to hacking and phishing attacks, as no passwords are stored or transmitted through vulnerable channels.
Solution Approach 2:
The patent uses disposable, short-lived authentication tokens in the form of push notifications. Each notification is unique to a specific access attempt and expires immediately after use. This eliminates the value of stolen credentials, as each authentication token is single-use and time-limited, making phishing and credential theft ineffective.
Data Source
AI summary
A request including a user identifier is received from a third party to authenticate an access attempt by a person. The input of the user identifier is not accompanied by a password. A listing of associated mobile devices is transmitted to the third party. The person selects a mobile device to which an authentication notification should be sent. The notification is pushed to the mobile device. A user of the device views the notification and verifies whether the access should be allowed or denied. If access should be allowed, a first one-time password (OTP) is generated and transmitted to an authentication server. The server generates a second OTP. If the second OTP matches the first OTP, the server notifies the third party that access should be permitted. If the second OTP does not match the first OTP, the server notifies the third party that access should be blocked.